Home
How-To and Troubleshooting References
Configuring Active-Standby BGP for Site-to-Site Through SASE (Quantum and Maestro)
This procedure explains when and how to configure active-standby BGP for site-to-site traffic through redundant VTI tunnels with SASE and Maestro deployments. It also describes prerequisites and primary-region selection considerations.
Step 4 - Configure BGP Peering and Bindings
This task explains how to configure BGP peering and route map bindings for primary and secondary peers. It includes the required commands for remote AS and peer configuration.

Important Information
Introduction to Check Point SASE
Getting Started
Migrating the SASE (Perimeter 81) Workspace to Check Point Portal
Dashboard
Team
Devices
Networks
Private Access
Internet Access
Threat Prevention Policy
Data Loss Prevention
SaaS API
Enterprise Browser
Monitor & Logs
Objects
Settings
Using Model Context Protocol (MCP) Server with SASE
Managed Service Providers
How-To and Troubleshooting References
- Troubleshooting Connectivity Issues with the Check Point SASE Agent
- Changing DNS Settings in Windows
- Changing DNS Settings in Mac
- Changing Region and Language for Accurate Google Search Results
- Generating an HTTP Archive (.HAR) File
- Troubleshooting Common Errors in IPsec Site-to-Site Connection Setup
- Configuring Active-Standby BGP for Site-to-Site Through SASE (Quantum and Maestro)
  This procedure explains when and how to configure active-standby BGP for site-to-site traffic through redundant VTI tunnels with SASE and Maestro deployments. It also describes prerequisites and primary-region selection considerations.
  - BGP Configuration in Gaia Clish
    Configure BGP settings in Gaia Clish by defining placeholders, AS information, and router ID values.
  - Step 2 - Configure Inbound Route Maps
    Configure inbound route maps to prefer the primary region for return traffic. Set lower preference values for routes learned from the primary peer.
  - Step 3 - Configure Outbound Route Maps
    Configure outbound route maps to advertise the LAN and prepend the AS path on the secondary path. Set the matched protocol according to how the LAN prefix exists on the gateway.
  - Step 4 - Configure BGP Peering and Bindings
    This task explains how to configure BGP peering and route map bindings for primary and secondary peers. It includes the required commands for remote AS and peer configuration.
  - Step 5 - Save the Configuration
    This task explains how to save the configuration and provides important notes about route maps and AS prepend configuration.
  - Verify on the Gateway
    Verify BGP configuration, peer status, route advertisements, and failover behavior on the active cluster member.
  - Validated Example
    This example shows sample BGP configuration values and commands for a lab environment. Replace the sample values with values from your environment before deployment.
Release Notes

Step 4 - Configure BGP Peering and Bindings

This task explains how to configure BGP peering and route map bindings for primary and secondary peers. It includes the required commands for remote AS and peer configuration.

Step 4 - Configure BGP Peering and Bindings

Run:

Run the following commands to configure BGP peering and bindings.

set bgp external remote-as <SASE_AS> on
                        set bgp external remote-as <SASE_AS> import-routemap sase_prim_in preference 1 on
                        set bgp external remote-as <SASE_AS> import-routemap sase_sec_in preference 2 onset bgp external remote-as <SASE_AS> peer <PRIMARY_PEER_VTI_IP> on
                        set bgp external remote-as <SASE_AS> peer <PRIMARY_PEER_VTI_IP> multihop on
                        set bgp external remote-as <SASE_AS> peer <PRIMARY_PEER_VTI_IP> graceful-restart on
                        set bgp external remote-as <SASE_AS> peer <PRIMARY_PEER_VTI_IP> export-routemap bgpout preference 100 onset bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> on
                        set bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> multihop on
                        set bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> graceful-restart on
                        set bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> export-routemap bgpout_sec preference 100 on

15 September 2026

© 2020 - 2026 Check Point Software Technologies Ltd.